Checkout Origin Guard protects your WooCommerce store from fake, fraudulent, or automated checkout attempts by identifying and blocking abusive origins before they clutter your order table or your logs.

The plugin runs client-origin heuristics, IP controls, and sequence analysis to detect non-human traffic and suspicious behavior at checkout. It adds Company Shield for business and email sanity checks and an optional AVS “U” signal handler for gateways that report “Address not checked / unavailable”.

All controls live on a single admin screen; you can adjust sensitivity, manage allowlists and blocklists, and review traffic logs in one place.

Three layers of protection

Bot Block (traffic level)
Detects and throttles abusive requests before they become orders:
- Analyzes user agents, referrers, and known bot signatures
- Counts final checkout submissions in fixed one-minute windows for classic AJAX and Checkout Blocks
- Supports monitor, soft, and hard blocking modes
- Built-in allowlist for search engines, uptime monitors, and core WordPress services
Company Shield (checkout level)
Validates business identity and email quality at checkout:
- Flags suspicious or synthetic business names
- Detects repeated syllables, odd vowel ratios, and gibberish patterns
- Identifies disposable email domains and role-based accounts (admin, info, sales, etc.)
- Can run in:
  - Monitor; log and annotate orders
  - Soft; create the order and automatically place it on hold or pending
  - Hard; block checkout with a user-facing error message
Payment AVS signals (post-payment; optional)
For gateways that expose AVS results in order meta, Checkout Origin Guard can treat “AVS: U; unavailable / not checked” as a risk signal:
- Does not change how your gateway authorizes or captures payments
- Can be configured to:
  - Ignore the signal
  - Add an order note only
  - Add an order note and bump a risk-score meta field
  - Put the order on hold for manual review
- Uses flexible pattern matching; can scan specific gateway meta keys or fall back to scanning all order meta for common “AVS: U” messages such as the PayPal string
- Off by default; you opt in and choose the behavior

Key Features

🛡️ Bot Block; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns.
⚡ Checkout Attempt Limits; Scores more than ten final order submissions from one IP within a fixed minute, without counting cart refreshes, coupon changes, or payment callbacks.
🧠 Company Shield; Reviews configured deny fragments, disposable email domains, and corroborating company-name patterns at checkout.
🌎 Allowlist Controls; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services.
🔒 Hard / Soft / Monitor Modes; Choose between logging only, soft blocking, or full hard blocking.
🧾 AVS “U” Risk Signals (optional); Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order.
🗂️ Log Viewer; See activity including timestamps, IPs, user agents, paths, and detection outcomes.
🧩 One-Page Dashboard; Configure settings, review logs, and manage allow/deny lists from a single screen.
🚫 Manual Block / Unblock; Instantly remove or restore access for specific IPs with one click.
💾 CSV Export; Download checkout-origin activity logs for security review or record keeping.

Why Online Shops Need it

WooCommerce checkouts are frequent targets for:

Card testing and BIN probing
Fake business registrations and spam accounts
Automated scripts hammering your checkout endpoints

Checkout Origin Guard focuses on checkout behavior and identity quality, not just generic firewall rules. It helps you:

Reduce chargeback and fraud risk
Keep your order list clean and reviewable
Shorten the time spent cleaning up junk orders and bogus signups

The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server.

Use Cases

Prevent card testing or order spam
Review orders with suspicious company names and email addresses
Detect rapid repeat checkout attempts from the same IP
Block suspicious POST requests that hit checkout endpoints
Add an extra layer of review for orders where the gateway reports “AVS unavailable / not checked”
Maintain cleaner order history and logs for real customers

Traffic protection and checkout compatibility

Monitor records traffic without enforcing score-based limits. Soft block returns HTTP 429 for scores of 60 or higher. Hard block returns HTTP 429 for scores of 60–79 and HTTP 403 for scores of 80 or higher. The separate Block Common Exploits setting is enabled by default and returns 403 for recognized sensitive-file, ALFA, and PHP-CGI probes in every mode, before allowlists. This protection applies only to requests that reach WordPress.

Classic checkout submissions and POST requests to the Store API checkout route are counted separately from ordinary browsing. More than ten submissions from the same IP within a fixed minute receive a high-risk score. GET/PATCH draft updates, cart refreshes, coupon requests, and gateway callbacks are excluded from this checkout-attempt limit. WooCommerce retains responsibility for nonce/cart-token validation and payment processing.

Company Shield supports classic checkout and Checkout Blocks. A lowercase name, missing referrer, role-based email address, or non-Latin company name alone does not reject or hold an order. Configured deny fragments, disposable domains, or multiple corroborating company-pattern signals can trigger the selected mode. Soft mode requests manual review; when payment advances a flagged order to processing/completed, it is placed on hold once. Staff can subsequently release it. This does not reverse or prevent an authorized payment.

Traffic logs include rule matches, crawler classification, request body type, and observed HTTP status in the dashboard and CSV export. The homepage is shown as /, and checkout routing is retained without recording arbitrary query strings, request bodies, or payment details. Logs are automatically retained for 30 days by default, configurable from 7 to 90 days. Older entries have blank values for the new details.

If your store is behind a CDN or reverse proxy, configure its actual connecting IP addresses or IPv4 CIDRs in Trusted proxies before enabling traffic blocking. Forwarded client-IP headers are ignored for untrusted peers. With no trusted proxies configured, the connecting address is used. Use Monitor to verify client addresses and legitimate checkout behavior before enabling enforcement.

Credits

Developed by Michael Winchester
For documentation and updates, visit https://michaelwinchester.com